Major companies like Uber and Microsoft have suffered massive data breaches, costing millions and highlighting the severe financial and reputational risks of poor security.
Writing secure code starts with fundamental practices like proper input validation, applying threat modeling methodologies like STRIDE, and adhering to the principle of least privilege.
Vulnerabilities in third-party libraries, like the SolarWinds and Log4j incidents, necessitate a DevSecOps approach to integrate security checks throughout the software development lifecycle.
Publicly exposed APIs must be protected using strong authentication, TLS/SSL encryption for data in transit, and defenses against common attack vectors.
Encrypting sensitive data at the database level protects it even if breached, while temporal tables provide a complete audit trail for forensic analysis.
Regular penetration testing, distinct from QA, should be a standard practice using methodologies like black-box or white-box testing and frameworks like the OWASP Top 10.
Avoid using company-issued laptops for personal or freelance projects to prevent legal liabilities and security compromises between environments.
The session concludes with answers to audience questions about tracking open-source vulnerabilities, choosing a pen test environment, and clarifying security roles within an agile team.
22:09Henning Harbs
1:58:48Thomas Konrad
29:47Thomas Chauchefoin & Paul Gerste
29:34Reto Kaeser
51:41Panel Discussion
37:32Martin Schmiedecker
48:02Tanya Janca
44:30Milecia McGregor
.png?w=240&auto=compress,format)
Jobs that call for the skills explored in this talk.
Excellence AG
e.solutions GmbH